CVE-2022-31087: Incorrect Default Permissions in ldap-account-manager
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files under www-data privileges can write a web-shell into this directory, and gain a Code Execution on the host. This issue has been fixed in version 8.0. Users unable to upgrade should disallow executing PHP scripts in (/var/lib/ldap-account-manager/)tmp directory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31087?
CVE-2022-31087 has not been assigned a specific CVSS score, but it poses significant risks due to the potential remote code execution from web-accessible PHP files.
How do I fix CVE-2022-31087?
To mitigate CVE-2022-31087, upgrade to LDAP Account Manager version 8.0.1-0+deb11u1 or version 8.3-1.
What versions of LDAP Account Manager are affected by CVE-2022-31087?
LDAP Account Manager versions prior to 8.0 are vulnerable to CVE-2022-31087.
Can CVE-2022-31087 be exploited remotely?
Yes, CVE-2022-31087 can potentially be exploited remotely if the tmp directory is accessible by an attacker.
What kind of attacks can CVE-2022-31087 allow?
CVE-2022-31087 may allow an attacker to execute arbitrary PHP code, leading to a full system compromise.